---
title: "PhaaS Host Feed"
method: POST
path: "/threat-feeds/phaas"
tags: ["Threat Feeds"]
---

# PhaaS Host Feed

`POST /threat-feeds/phaas`

Cursor-paginated feed of Phishing-as-a-Service host rows. Requires `phaas_threat_feed`.

## Request body

- object
  - `date` string — A single UTC day (YYYY-MM-DD). Ignored if a range is given.
  - `dateFrom` string — Inclusive range start on `dayUtc`.
  - `dateTo` string — Inclusive range end on `dayUtc`.
  - `host` string — Exact host match (lower-cased, trimmed).
  - `family` string — Phishing-kit name membership (lower-cased).
  - `country` string — ISO-2 country, exact (upper-cased).
  - `feedType` string
  - `asn` integer — Autonomous system number.
  - `sort` 'date' | 'seen' | 'host'
  - `dir` 'asc' | 'desc'
  - `cursor` string — Opaque keyset cursor from a previous response's `pageInfo.nextCursor`.
  - `limit` integer
  - `withTotal` boolean

## Response `200`

Successful operation

- object
  - `data` object[]
    - `_id` string
    - `host` string
    - `dayUtc` string
    - `feedType` string, nullable
    - `families` string[] — Phishing-kit names associated with the host.
    - `tags` string[]
    - `infraType` string, nullable
    - `country` string, nullable
    - `asn` integer, nullable
    - `asOrg` string, nullable
    - `resolvedIps` string[]
    - `ports` integer[]
    - `sha256` string[]
    - `dnsActivity` integer
    - `dnsActivityByWindow` object[]
      - `windowDays` integer
      - `count` integer
    - `passiveDnsHits` integer
    - `trancoRank` integer, nullable
    - `firstSeen` string, nullable
    - `lastSeen` string, nullable
    - `addedAt` string, nullable
    - `createdAt` string, date-time
    - `updatedAt` string, date-time
  - `pageInfo` object
    - `limit` integer
    - `count` integer
    - `hasMore` boolean
    - `nextCursor` string, nullable
    - `total` integer
    - `sort` object
      - `key` string
      - `dir` 'asc' | 'desc'

## Other responses

- `400` — Validation error.
- `401` — Missing or invalid `api-key`.
- `403` — The API key lacks the required permission for this feed.
- `500` — Internal server error.

---

[API](https://skmtc.net/hudsonrock/apis/cavalier-api.md) · [All operations](https://skmtc.net/hudsonrock/apis/cavalier-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/hudsonrock/cavalier-api/revisions/5ba0142eec4d/schema)